Vulnerabilities > Apple > Safari > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-02-20 | CVE-2016-7592 | Information Exposure vulnerability in Apple products An issue was discovered in certain Apple products. | 4.3 |
| 2017-02-20 | CVE-2016-7586 | Information Exposure vulnerability in Apple products An issue was discovered in certain Apple products. | 6.5 |
| 2017-02-20 | CVE-2016-4613 | Information Exposure vulnerability in Apple products An issue was discovered in certain Apple products. | 6.5 |
| 2016-09-25 | CVE-2016-4763 | Cryptographic Issues vulnerability in Apple Itunes WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | 6.8 |
| 2016-09-25 | CVE-2016-4760 | Improper Access Control vulnerability in Apple Itunes WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support. | 6.5 |
| 2016-09-25 | CVE-2016-4758 | Information Exposure vulnerability in Apple Safari WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site. | 6.5 |
| 2016-09-25 | CVE-2016-4618 | Cross-site Scripting vulnerability in Apple Iphone OS and Safari Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)." | 6.1 |
| 2016-09-06 | CVE-2016-7153 | Information Exposure vulnerability in multiple products The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack. | 5.3 |
| 2016-09-06 | CVE-2016-7152 | Information Exposure vulnerability in multiple products The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack. | 5.3 |
| 2016-07-22 | CVE-2016-4651 | Cross-site Scripting vulnerability in Apple Iphone OS and Safari Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability. | 6.1 |